WorkloadIdentity
Identity bound to a running workload via platform attestation (IRSA, WI, pod identity).
class: Identity derivation-only - no collection recipe
Realizing resources
This type has no collection recipe - it appears only as the endpoint of derived edges.
As edge source
AuthenticatesToCanAddMemberCanAdministerCanAssumeCanAttachIdentityCanControlCanCreateCanCreateCredentialForCanCreateKeyCanCreateWorkloadAsCanDecryptCanDelegateCanDeleteCanDeleteDataCanDeployCanEnterAccountCanEnterOrganizationCanEnterProjectCanEnterSubscriptionCanEnterTenantCanEscalateToCanExecuteAsCanExecuteCommandCanExecuteOnCanExfiltrateCanExportKeyCanFederateAsCanGrantPermissionCanImpersonateCanInvokeCanModifyCanModifyCodeCanModifyConfigurationCanModifyPolicyCanModifyTrustCanNetworkReachCanPassIdentityCanReadCanReadCredentialCanReadDataCanReadSecretCanRemoveMemberCanReplaceCanResetCredentialCanRetrieveTokenCanScheduleCanSignAsCanStartCanTakeOwnershipCanTriggerCanWriteCanWriteDataControlsExposedToAccountExposedToTenantExternalIdentityMapsToFederatesToHasPermissionHasPolicyHasRoleLocatedInMemberOfAs edge target
AttachedToAuthenticatesToCanAdministerCanControlCanCreateCanCreateCredentialForCanCreateWorkloadAsCanDelegateCanDeleteCanEscalateToCanExecuteAsCanGrantPermissionCanImpersonateCanModifyCanModifyConfigurationCanModifyPolicyCanReadCanReplaceCanResetCredentialCanRetrieveTokenCanTakeOwnershipCanWriteContainsContainsResourceReferenceControlsCredentialValidForCredentialsForExecutesAsExposesCredentialExternalIdentityMapsToFederatesToHasPermissionTrustsExternalIdentityExposure sites
aws-acm-exported-private-key-outputaws-amplify-webhook-url-outputaws-apigateway-rest-api-key-valueaws-cloudformation-stack-output-valueaws-cloudhsm-extractable-key-material-data-planeaws-codeartifact-authorization-token-outputaws-codebuild-exported-environment-variable-outputaws-codebuild-webhook-secret-output
Rules that touch WorkloadIdentity 15
A Kubernetes ServiceAccount annotated with eks.amazonaws.com/role-arn maps to that IAM role; the mapping is realized when the role trust allows the cluster OIDC issuer + sub for this SA.
A Kubernetes ServiceAccount annotated with eks.amazonaws.com/role-arn and a matching IAM role trust policy (Federated = cluster OIDC issuer) lets any pod running as that KSA exchange its projected token for IAM role credentials via sts:AssumeRoleWithWebIdentity. Cites container-chains workload-identity-federates and federation-chains federation-maps-to-identity.
aws
CanFederateAsAn EKS Pod Identity Association (eks:CreatePodIdentityAssociation) links a Kubernetes namespace:ServiceAccount pair to an IAM role. Pods running as that SA receive IAM credentials from the eks-pod-identity-agent at 169.254.170.23. Whoever can create or modify this association can reroute which IAM role any pod in that namespace:SA binding runs as.
aws
CanFederateAsAn EKS Pod Identity Association explicitly maps a namespace:SA pair to an IAM role; the mapping is backed by the role trust trusting pods.eks.amazonaws.com.
Cluster-admin kubeconfig -> exec any pod -> execute as every pod workload identity (cluster-wide summary edge; per-pod edges from container-chains cluster-rbac-exec).
azure
CanExecuteAsrunCommand grants cluster-wide kubectl exec; any pod's workload identity is reachable by exec-ing into the pod (container-chains cluster-rbac-exec).
azure
CanExecuteAsExec into a pod (cluster RBAC / credential / run-command) inherits the pod's mounted ServiceAccount/IRSA/Workload-Identity token, executing as that identity.
Federating into a Role homed in an AWS account gives the federated principal a foothold in that account.
Reading a credential that is credentials for an identity yields the ability to authenticate as that identity.
Reading a secret that is credentials for an identity yields the ability to authenticate as that identity.
Signing tokens as an identity yields impersonation when a downstream trust validates those signatures.
A Kubernetes workload-identity binding (KSA<->GSA / IRSA / AKS Workload Identity) lets the pod's projected SA token federate into a cloud Role/ServiceAccount; escalation roll-ups are federation-chains'.